crypto_cs.c File Reference

Clause Blind Schnorr signatures using Curve25519. More...

#include "platform.h"
#include "gnunet_util_lib.h"
#include <sodium.h>
#include <gcrypt.h>

Include dependency graph for crypto_cs.c:

Go to the source code of this file.

Functions
void	GNUNET_CRYPTO_cs_private_key_generate (struct GNUNET_CRYPTO_CsPrivateKey *priv)
	IMPLEMENTATION NOTICE:
void	GNUNET_CRYPTO_cs_private_key_get_public (const struct GNUNET_CRYPTO_CsPrivateKey *priv, struct GNUNET_CRYPTO_CsPublicKey *pub)
	Extract the public key of the given private key.
static void	map_to_scalar_subgroup (struct GNUNET_CRYPTO_Cs25519Scalar *scalar)
	Maps 32 random bytes to a scalar.
void	GNUNET_CRYPTO_cs_r_derive (const struct GNUNET_CRYPTO_CsSessionNonce *nonce, const char *seed, const struct GNUNET_CRYPTO_CsPrivateKey *lts, struct GNUNET_CRYPTO_CsRSecret r[2])
	Derive a new secret r pair r0 and r1.
void	GNUNET_CRYPTO_cs_r_get_public (const struct GNUNET_CRYPTO_CsRSecret *r_priv, struct GNUNET_CRYPTO_CsRPublic *r_pub)
	Extract the public R of the given secret r.
void	GNUNET_CRYPTO_cs_blinding_secrets_derive (const struct GNUNET_CRYPTO_CsBlindingNonce *blind_seed, struct GNUNET_CRYPTO_CsBlindingSecret bs[2])
	Derives new random blinding factors.
static void	cs_full_domain_hash (const struct GNUNET_CRYPTO_CsRPublic *r_dash, const void *msg, size_t msg_len, const struct GNUNET_CRYPTO_CsPublicKey *pub, struct GNUNET_CRYPTO_CsC *c)
	Computes a Hash of (R', m) mapped to a Curve25519 scalar.
static void	calc_r_dash (const struct GNUNET_CRYPTO_CsBlindingSecret *bs, const struct GNUNET_CRYPTO_CsRPublic *r_pub, const struct GNUNET_CRYPTO_CsPublicKey *pub, struct GNUNET_CRYPTO_CsRPublic *blinded_r_pub)
	calculate R'
void	GNUNET_CRYPTO_cs_calc_blinded_c (const struct GNUNET_CRYPTO_CsBlindingSecret bs[2], const struct GNUNET_CRYPTO_CsRPublic r_pub[2], const struct GNUNET_CRYPTO_CsPublicKey *pub, const void *msg, size_t msg_len, struct GNUNET_CRYPTO_CsC blinded_c[2], struct GNUNET_CRYPTO_CSPublicRPairP *r_pub_blind)
	Calculate two blinded c's.
void	GNUNET_CRYPTO_cs_sign_derive (const struct GNUNET_CRYPTO_CsPrivateKey *priv, const struct GNUNET_CRYPTO_CsRSecret r[2], const struct GNUNET_CRYPTO_CsBlindedMessage *bm, struct GNUNET_CRYPTO_CsBlindSignature *cs_blind_sig)
	Sign a blinded c.
void	GNUNET_CRYPTO_cs_unblind (const struct GNUNET_CRYPTO_CsBlindS *blinded_signature_scalar, const struct GNUNET_CRYPTO_CsBlindingSecret *bs, struct GNUNET_CRYPTO_CsS *signature_scalar)
	Unblind a blind-signed signature using a c that was blinded.
enum GNUNET_GenericReturnValue	GNUNET_CRYPTO_cs_verify (const struct GNUNET_CRYPTO_CsSignature *sig, const struct GNUNET_CRYPTO_CsPublicKey *pub, const void *msg, size_t msg_len)
	Verify whether the given message corresponds to the given signature and the signature is valid with respect to the given public key.

Variables
static const unsigned char	L_BIG_ENDIAN [32]

Detailed Description

Clause Blind Schnorr signatures using Curve25519.

Author

Lucien Heuzeveldt lucie.nosp@m.ncla.nosp@m.ude.h.nosp@m.euze.nosp@m.veldt.nosp@m.@stu.nosp@m.dents.nosp@m..bfh.nosp@m..ch

Gian Demarmels gian@.nosp@m.dema.nosp@m.rmels.nosp@m..org

Definition in file crypto_cs.c.

Function Documentation

map_to_scalar_subgroup()

static void map_to_scalar_subgroup ( struct GNUNET_CRYPTO_Cs25519Scalar *  scalar )

static

Maps 32 random bytes to a scalar.

This is necessary because libsodium expects scalar to be in the prime order subgroup.

Parameters

[in,out]

scalar

containing 32 byte char array, is modified to be in prime order subgroup

Definition at line 69 of file crypto_cs.c.

{
  /* perform clamping as described in RFC7748 */
  scalar->d[0] &= 248;
  scalar->d[31] &= 127;
  scalar->d[31] |= 64;
}

References GNUNET_CRYPTO_Cs25519Scalar::d.

Referenced by GNUNET_CRYPTO_cs_blinding_secrets_derive(), and GNUNET_CRYPTO_cs_r_derive().

Here is the caller graph for this function:

cs_full_domain_hash()

static void cs_full_domain_hash ( const struct GNUNET_CRYPTO_CsRPublic *  r_dash, const void *  msg, size_t  msg_len, const struct GNUNET_CRYPTO_CsPublicKey *  pub, struct GNUNET_CRYPTO_CsC *  c  )

static

Computes a Hash of (R', m) mapped to a Curve25519 scalar.

Parameters

	hash	initial hash of the message to be signed
	pub	denomination public key (used as salt)
[out]	c	C containing scalar

Definition at line 148 of file crypto_cs.c.

{
  // SHA-512 hash of R' and message
  struct GNUNET_HashCode prehash;
  gcry_mpi_t l_mpi;
  gcry_mpi_t c_mpi;
  unsigned char c_big_endian[256 / 8];
  size_t r_m_concat_len = sizeof(struct GNUNET_CRYPTO_CsRPublic) + msg_len;
  char r_m_concat[r_m_concat_len];
  memcpy (r_m_concat,
          r_dash,
          sizeof(struct GNUNET_CRYPTO_CsRPublic));
  memcpy (r_m_concat + sizeof(struct GNUNET_CRYPTO_CsRPublic),
          msg,
          msg_len);
 
  GNUNET_CRYPTO_hash (r_m_concat,
                      r_m_concat_len,
                      &prehash);
 
  // modulus converted to MPI representation
  GNUNET_CRYPTO_mpi_scan_unsigned (&l_mpi,
                                   L_BIG_ENDIAN,
                                   sizeof(L_BIG_ENDIAN));
 
  // calculate full domain hash
  GNUNET_CRYPTO_kdf_mod_mpi (&c_mpi,
                             l_mpi,
                             pub,
                             sizeof(struct GNUNET_CRYPTO_CsPublicKey),
                             &prehash,
                             sizeof(struct GNUNET_HashCode),
                             "Curve25519FDH");
  gcry_mpi_release (l_mpi);
 
  // convert c from mpi
  GNUNET_CRYPTO_mpi_print_unsigned (c_big_endian,
                                    sizeof(c_big_endian),
                                    c_mpi);
  gcry_mpi_release (c_mpi);
  for (size_t i = 0; i<32; i++)
    c->scalar.d[i] = c_big_endian[31 - i];
}

References GNUNET_CRYPTO_Cs25519Scalar::d, GNUNET_CRYPTO_hash(), GNUNET_CRYPTO_kdf_mod_mpi(), GNUNET_CRYPTO_mpi_print_unsigned(), GNUNET_CRYPTO_mpi_scan_unsigned(), L_BIG_ENDIAN, msg, pub, and GNUNET_CRYPTO_CsC::scalar.

Referenced by GNUNET_CRYPTO_cs_calc_blinded_c(), and GNUNET_CRYPTO_cs_verify().

Here is the call graph for this function:

Here is the caller graph for this function:

calc_r_dash()

static void calc_r_dash ( const struct GNUNET_CRYPTO_CsBlindingSecret *  bs, const struct GNUNET_CRYPTO_CsRPublic *  r_pub, const struct GNUNET_CRYPTO_CsPublicKey *  pub, struct GNUNET_CRYPTO_CsRPublic *  blinded_r_pub  )

static

calculate R'

Parameters

	bs	blinding secret
	r_pub	R
	pub	public key
[out]	blinded_r_pub	R'

Definition at line 206 of file crypto_cs.c.

{
  // R'i = Ri + alpha i*G + beta i*pub
  struct GNUNET_CRYPTO_Cs25519Point alpha_mul_base;
  struct GNUNET_CRYPTO_Cs25519Point beta_mul_pub;
  struct GNUNET_CRYPTO_Cs25519Point alpha_mul_base_plus_beta_mul_pub;
  GNUNET_assert (0 ==
                 crypto_scalarmult_ed25519_base_noclamp (
                   alpha_mul_base.y,
                   bs->alpha.d));
  GNUNET_assert (0 ==
                 crypto_scalarmult_ed25519_noclamp (
                   beta_mul_pub.y,
                   bs->beta.d,
                   pub->point.y));
  GNUNET_assert (0 == crypto_core_ed25519_add (
                   alpha_mul_base_plus_beta_mul_pub.y,
                   alpha_mul_base.y,
                   beta_mul_pub.y));
  GNUNET_assert (0 ==
                 crypto_core_ed25519_add (
                   blinded_r_pub->point.y,
                   r_pub->point.y,
                   alpha_mul_base_plus_beta_mul_pub.y));
}

References GNUNET_CRYPTO_CsBlindingSecret::alpha, GNUNET_CRYPTO_CsBlindingSecret::beta, GNUNET_CRYPTO_Cs25519Scalar::d, GNUNET_assert, GNUNET_CRYPTO_CsRPublic::point, pub, and GNUNET_CRYPTO_Cs25519Point::y.

Referenced by GNUNET_CRYPTO_cs_calc_blinded_c().

Here is the caller graph for this function:

Variable Documentation

L_BIG_ENDIAN

const unsigned char L_BIG_ENDIAN[32]

static

Initial value:

= {
  0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  0x00, 0x00, 0x00, 0x00, 0x00, 0x14, 0xde, 0xf9, 0xde, 0xa2, 0xf7,
  0x9c, 0xd6, 0x58, 0x12, 0x63, 0x1a, 0x5c, 0xf5, 0xd3, 0xed
}

Definition at line 133 of file crypto_cs.c.

                                              {
  0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  0x00, 0x00, 0x00, 0x00, 0x00, 0x14, 0xde, 0xf9, 0xde, 0xa2, 0xf7,
  0x9c, 0xd6, 0x58, 0x12, 0x63, 0x1a, 0x5c, 0xf5, 0xd3, 0xed
};

Referenced by cs_full_domain_hash().